Future Leaders Award

ROADMAP — FLA Event & Awards Platform

Living plan. Status: ✅ done · 🚧 in progress · ✅ planned.
Browse in-app at /docs/roadmap. Spec: docs/SRS.md. Handoff: TODO.md.

Vision

A modular, plain-PHP platform at https://event.production1.jugaar.ai for running events whose centerpiece is public-voted, AI-assessed awards — branded entirely from an admin control panel, auditable end-to-end, and shareable by design (everyone gets cards + links worth posting).

Milestones

Status 2026-09-14: v5.8.0 live — resilience hardening (questionnaire auto-save,
parallel JSON backup, nomination dedup, error logging, DB reconnect, log rotation,
orphan cleanup, staleness indicators, nginx production config). Staging QA 37/37.

v5.8.0 — Resilience & disaster-recovery backup ✅ (delivered 2026-09-14)

  • Questionnaire auto-save drafts (questionnaire_drafts table, AJAX 2s debounce).
  • Parallel JSON Lines backup for questionnaires, nominations, votes (storage/backup-data/).
  • Nomination duplicate prevention (unique constraint + graceful message).
  • Error logging: error_log path, 404/403 logging, session GC alignment.
  • DB auto-reconnect on "MySQL server has gone away".
  • Log rotation script, orphan upload cleanup script, bulk JSON export tool.
  • AJAX staleness indicator on live pollers (vote counter, notification badge).
  • Nginx production config (fla.events.jugaar.ai, access/error log, media bypass).
  • Backup.sh includes storage/backup-data/ in tarball.

v5.4.1 — Held-vote management + gap analysis ✅ (delivered 2026-09-10)

  • /admin/votes: held-vote review queue — Release / Reject / Release-all with

audits + voter notification; closes the vote-abuse intervention loop.

  • docs/GAP-ANALYSIS.md (team-gated): G1 deploy parity, G2 owner keys,

G3 i18n + cutover, G4 structural, G5 event-day status.

  • E2E phase 28 (burst → hold → release → reject); suite 290/290; webhook

listener multi-worker (last marginal check eliminated).

v5.4.0 — Multi-page FLA site + generated art ✅ (delivered 2026-09-10)

  • Real pages: /about /categories /jury /agenda /contact (theme-gated routes);

nav anchors → pages; cinematic home (generated 16:9 hero, glass countdown, stats band, teasers, CTA band); agenda as gold timeline.

  • Midnight-gold design system (body.fla-dark + fla-* components).
  • 10 category arts + wide hero generated via MiniMax image-01 in-platform

(external images-hub upstream down); fla_cat_art() name→art mapping.

  • SIFC sponsor removed; admin audit fixes (media placeholder 500, dashboard

tooltip overflow, print-layout brand-ink, sidebar/pill contrast).

v5.3.1–v5.3.2 — Visual audit + owner-review redesign ✅ (delivered 2026-09-10)

  • CSP style-src nonce bug fixed (inline style attributes were stripped site-wide);

brand-contrast tokens --brand-ink/--brand-strong; muted AA.

  • Owner review: founder section removed; Explore Categories rebuilt (grid

auto-fit minmax(0,1fr) bug made 10 sliver columns); grids fixed site-wide.

v5.3.0 — Audit & hardening round ✅ (delivered 2026-09-10)

  • Full logic + UI/UX audit; all Critical/High/Medium/Low findings fixed (see CHANGELOG).
  • CSP-safe JS everywhere: data-confirm/data-autosubmit/data-print/data-copy

delegates; stage gate, MC console and queue rebuilt on delegated events.

  • Logic: vote-count API gated (BR-006), hall-of-fame/alumni respect reveal_mode,

hash-chain tail re-seal on vote change (deterministic verifier stays green), capacity/waitlist transacted with seat-vs-queue semantics, comms >100 via job queue.

  • UI: app.css de-duplicated (687 lines), Inter applies, dark-mode FOUC gone,

QR badges self-generated, a11y fixes (skip-link, errors, guided tour).

  • Git restored: baseline commit + tag v5.2.2, annotated tag per milestone resumes.

v4.2.0 — Completion round ✅ (delivered 2026-09-07)

  • Recurring events (weekly/monthly, repeat-until, auto-drafted next occurrence via queue cron).
  • Guided tour (4-step spotlight on admin overview, per-user, dismissible).
  • Judges transparency panel on public results (post-lock).
  • Fixed: vote-change reason silently dropped (rechain() bug — the "flaky" E2E test);

event-create INSERT regression. E2E 266/266.

  • Opt-in persistent PDO pooling; full a11y sweep (alt text everywhere, focusable mains).

v4.1.0 — Visual/UX audit round ✅ (delivered 2026-09-06)

  • Root cause: every /media/ image 404 — nginx static-cache intercepted before PHP; bypass added.
  • Missing uploads serve graceful placeholders (no broken-image icons ever).
  • Admin shell was JS-less: app.js (toasts/theme), burger drawer on mobile.
  • Hall of fame paginated (mobile page 36,526px → 8,157px); touch-target + contrast fixes;

WebP backgrounds (78–96% smaller); HTTP/2.

v4.0.0 — Gap-closure ✅ (delivered 2026-09-06)

  • Vote management (soft-delete + /admin/votes, audited, reversible) · event templates ·

admin onboarding checklist · public /speakers GoH directory · candidate compare · event package JSON export · hall-of-fame search · .ics calendar export · Telegram ops alerts · async job queue (bin/queue.php, cron) · structured login_attempts.

v3.5.0 – v3.9.0 — UX, trust & imagery ✅ (delivered 2026-09-03 → 2026-09-05)

  • Dark mode, toasts, notification badges, mobile tabs, skeletons, breadcrumbs, countdown.
  • Vote-abuse intervention (auto-hold bursts), sponsor ROI dashboard, alumni network, email digest.
  • MiniMax M3 live (interviews, assistant, briefs, insights); AI-generated hero/category art

(WebP), share cards (GD + Brainiall driver ready, quota resets monthly).

v3.4.0 — Event-day readiness & trust ✅ (delivered 2026-09-02)

  • Ceremony media upload UI on /admin/ceremony/setup (anthem video, fanfare audio, custom slides).
  • One-click backup button on /admin/system.
  • Printable name badges (/badges) with check-in QR; run-sheet already present.
  • Post-event feedback survey (/survey) → engagement score.
  • Public /about-scoring transparency hub (weights, rubric, hash-chain verify, lock metadata).
  • Data-retention jobs (/admin/retention): page_views rollup, audit_log archive, mail-log hygiene.
  • CSP hardening: removed 'unsafe-inline' from script-src, nonce-based inline scripts.
  • E2E extended to 266 checks (all green); surface QA 37 checks (all green).

v0.1.0 — Docs & Scaffold ✅

  • Plain-PHP modular scaffold (Core + 14 Modules), views, config, composer (autoload only).
  • Living docs: SRS, 7 workflows, TODO, ROADMAP, CHANGELOG, WORKFLOW, HELP, AGENTS.
  • Docs viewer: every .md rendered as organized webpages at /docs.
  • Core services: AI gateway (MiniMax m3 driver + mock), LinkedIn (+mock), WhatsApp (null), GD cards.
  • DB migrations 001–009 + seed (settings, toggles).
  • Git baseline + tag.

v0.2.0 — Admin Core & Branding ✅ (delivered in v1.0.0 drop)

  • Admin auth + first admin (seeded, forced password change).
  • Branding control panel (name, logo upload, colors, tagline, campaign texts).
  • Feature toggles UI; audit writer wired in.
  • Admin home starter: KPI cards + first chart (registrations over time) using Chart.js.

v0.3.0 — Events & Categories ✅

  • Event CRUD + status lifecycle; category CRUD, show/hide, ordering.
  • Public event pages (details, categories list).

v0.4.0 — Registration ✅

  • Visitor, Award, Guest-of-Honor flows (LinkedIn OAuth + basic + WhatsApp).
  • Photo upload; staff manual entry; BR-001/002/007 enforced.
  • "I am visiting / I have applied" cards wired to success pages.

v0.5.0 — AI Interview ✅

  • Admin question bank per category; randomized session; progressing UI.
  • MiniMax m3 marking (score + feedback); session stats; fallback to mock.

v0.6.0 — Public Voting & Cards ✅

  • Share links, candidate pages (OG tags), LinkedIn voter auth, restriction modes,

optional voter reason, 70/30 engine, veto UI.

  • Public cards polished (better templates/fonts); AI card driver pluggable.

v0.7.0 — Judges Panel ✅

  • Judge accounts + assignments; review board; decisions + notes; admin report.

v0.8.0 — Dashboards, Tickets, Comms ✅

  • Admin dashboard full: graphs (votes-over-time, funnel, per-category shares, top candidates, AI score distribution), KPI cards with 7d/30d trends, audit-log tab with filters, drill-down lists.
  • AI insights (FR-0407): weekly event summary, judge-ready applicant briefs, vote-anomaly flags — mock-compatible until MiniMax key.
  • Applicant (own votes chart/voters/AI stats/tickets/cards), staff queue.
  • Ticketing system; mass comms (email + WhatsApp simulated→live); notifications + reminders.

v0.9.0 — Winners & Audit ✅

  • Finalize (blend, veto, approve & lock), public results, winner badges/cards.
  • Audit log viewer (filter/search).

v1.0.0 — Launch Polish ✅

  • Full responsive pass; accessibility; rate limiting; backups verified; perf pass;

owner walkthrough + go-live checklist.

Post-1.0 releases

v1.1.0 — Duplicate candidate detection ✅

  • BR-011 repeat-candidate surveillance: email/LinkedIn/CNIC-hash/name+WhatsApp signals +

same-account repeat detection; flag + alert admin (never auto-block).

  • Admin review queue /admin/duplicates (confirm → auto-veto / dismiss), badges + KPI.
  • CNIC mandatory on award forms (hash-only storage). Judges anchoring fix (SRS A2).
  • E2E: bin/qa-e2e.sh extended to 50 checks (all green).

v1.2.0 — Release-control completions ✅

  • Winner un-lock flow (retract results, revert statuses, event→judging, audited) — FR-1005.
  • Team password reset by admin (temp pass re-issue + forced change) — FR-0705.
  • E2E extended to 63 checks (all green).

v1.3.0 — Polish pack ✅

  • Email verification for non-LinkedIn signups (log mailer mock-safe) — FR-0309/0310.
  • Per-event vote-change policy toggle — FR-0509 (audited vote.changed).
  • ?ref= share-link attribution → applicant channel breakdown — FR-0510.
  • Finalist certificate cards — FR-0604. Security headers incl. HSTS — NFR-11.
  • E2E extended to 76 checks (all green).

v1.4.0 — Public discovery & ops ✅

  • Events directory /events (live + archive) — FR-0204 · Hall of fame /hall-of-fame — FR-1006.
  • Printable winner/finalist certificates — FR-0605 · Public read-only JSON API v1 — FR-1500.
  • robots.txt + dynamic sitemap.xml · vote rate limiting per IP (NFR-12) ·

bin/backup.sh (DB+storage, 14-day retention).

  • E2E extended to 91 checks (all green).

v1.5.0 — Integrations & experience ✅

  • Webhooks (signed JSON POSTs, subscriptions, delivery log, test ping) — FR-1601.
  • Venue leaderboard screen /screen/{slug} — FR-1602 · CSV exports — FR-1603.
  • Admin 2FA (TOTP, RFC 6238) — FR-1604 · PWA installable (manifest/icons/SW) — NFR-13.
  • E2E extended to 110 checks (all green).

v1.6.0 — Scale & polish ✅

  • Maintenance mode (503 + admin bypass, toggle in /admin/toggles) — FR-0106.
  • Bulk approve/reject for registrations — FR-1604 · Audit CSV export — FR-1103.
  • System health dashboard /admin/system — NFR-15 (DB/storage/queues/backups).
  • Hardened: toggles no longer clear on maintenance-only posts; vote guards + audit.
  • E2E extended to 119 checks (all green).

v1.7.0 — Photo flexibility ✅

  • B: Award/GoH photo optional at signup, upload/change via POST /dashboard/photo on member dashboard (Pakistan UX).
  • Approval (single + bulk) blocked until photo exists — audited, UI shows ?err=nophoto / ?skipped.
  • Docs: SRS FR-0304/0305/0308 + UC-04/05 updated; E2E 119/119 + 33/33 green.

v1.8.0 — Search & verification ✅

  • Global admin search /admin/search + header box — FR-1606.
  • SMS comms channel (log transport, Pakistan-ready) — FR-0906.
  • QR verification on printable certificates + public verify page — FR-0606.
  • E2E extended to 131 checks (all green).

v2.0.0 — Program growth & ops ✅ (A→M, one release)

  • Nominations (invite→convert) · AI Assistant (context-aware, multi-chat) · Judge rubric.
  • Cert numbers · Ceremony reveal · Capacity+waitlist · Scheduled comms · Embed widget.
  • Data rights · Auditor role · Event cloning · wa.me links · Public caching.
  • E2E extended to 169 checks (all green) + surface 33/33.

v2.1.0 — Reach ✅

  • Web Push end-to-end (pure PHP VAPID+RFC8291, admin broadcast, winner auto-push) — FR-1820.
  • CSV bulk import — FR-0311 · waitlist UI chip · nomination throttle setting.
  • E2E extended to 178 checks (all green).

v2.2.0 — Section 2 core ✅

  • GoH decision emails/SMS + submit confirmation — FR-0305b · GoH card — FR-0608.
  • GoH event-page listing · ratings + roster — FR-0620 · public profiles + socials — FR-1701.
  • E2E extended to 190 checks (all green).

v2.3.0 — Engage ✅

  • Magic-link member login — FR-0180 · messaging team↔members — FR-1830.
  • AI drafting (composer + bulk per-GoH) — FR-1840 · scheduling both directions — FR-1850.
  • E2E extended to 211 checks (all green).

v2.4.0 — Track & Trust ✅

  • People tracking + engagement + timelines — FR-1860 · anonymous page views (hashed).
  • Vote receipts + hash chain + public verification — FR-1870.
  • AI category fit — FR-1880 · share-link click analytics — FR-1890.
  • E2E extended to 223 checks (all green).

v2.5.0 — Section 3: Day of Event ✅

  • QR check-in · presenters + printable run-sheet · media gallery (both phases) · ceremony ops.

v2.6.0 — Growth ✅

  • Sponsor wall · season report. E2E final: 239 checks (all green).

v3.0.0 — Ceremony Production System ✅

  • MC Dashboard /mc (dedicated role, full show control) — FR-3000.
  • Stage Screen /stage/{slug} (polling, multi-GoH, anthem) — FR-3010.
  • Award Team /award-team (shield confirmation) — FR-3030.
  • Winner Queue + Shields + Admin Override — FR-3020/3040.
  • GoH Substitution + Self Check-in + Multi-GoH Presenters — FR-3050/3060/3070.
  • Ceremony Auto-generate from event data — FR-3080. Migration 027.
  • E2E extended to 260 checks (all green).

v3.1.1 — Security hotfix (audit) ✅

  • Pre-auth account-takeover closed (forms never auto-login; magic-link defer).
  • Veto absoluteness (BR-005) before any UPDATE; forced password change enforced.
  • Check-in secret split from public share token; LinkedIn account linking;

2FA/login per-account throttling; judge recusal withdraws scores; ops docs gated.

v3.1.2 — Integrity milestone (audit) ✅

  • DB::transaction() + transactions around winner lock/unlock, vote cast,

magic-link consume, ceremony generate, queue reorder; advisory locks for vote-chain tail and cert sequence.

  • Deterministic vote hash chain (recomputable chainVerified()); finalist

runner-up promotion (certs/cards live); vote races closed; card cache fixed.

  • Comms scheduling honored on send + retry-failed; profile vote-count gating;

MC cross-event slide guard; event FSM; version from config.

v3.2.0 — Event-Day UX ✅

  • Stage screen start gate (sound/fullscreen), heartbeat, live sponsor slide,

real pre-flight checklist; MC keyboard shortcuts; award-team auto-refresh.

  • Old-input forms, a11y pass, category rosters, sidebar completeness, favicon

upload, 500 page, asset cache-busting, OG tags, bug fixes across admin views.

  • E2E extended to 266 checks (all green).

Feature / enhancement backlog (post-1.0 ideas)

Event-day readiness (from the 2026-08-31 audit, ordered by value)

  • Media upload UI on /admin/ceremony/setup (anthem video, fanfare, slide images).
  • One-click backup button on /admin/system; quick "all attendees" push/comms preset.
  • Printable name badges with the dedicated check-in QR; day-of runbook page.
  • Post-event feedback survey (1–5 + comment) feeding the engagement score.
  • Ticket upgrades: attachments, internal staff notes, escalation flags + mail.

Trust & growth (mission-aligned, from the audit)

  • Public /about-scoring transparency hub (weights, rubric, hash-chain verify, lock metadata).
  • Vote-abuse intervention loop (auto-hold bursts, LinkedIn re-verify, clean-vote % KPI).
  • Sponsor ROI dashboard (impressions/clicks from page_views, per-tier CSV export).
  • Per-applicant judge-ready AI brief on the review page (FR-0407 completion).
  • Jury transparency post-lock (judge counts, rubric distributions, recusal register).
  • Season/alumni network (cross-season hall-of-fame profiles, finalist priority list).
  • Bilingual UI (EN/UR) + RTL for the Pakistani audience.

Engineering

  • Pagination UI for big admin lists (registrations/people/audit).
  • CSP hardening — remove 'unsafe-inline' (needs inline script/style extraction).
  • Data-retention jobs (page_views rollup, audit_log archive, log-mailer cleanup).
  • More OAuth providers for voters (X, Google). Referral tracking (done v1.3.0).
  • AI-generated share cards (cards.driver=ai) once an image API key is provided.
  • Multi-event homepage, leaderboard, PWA, REST API, webhooks (v1.4–1.5).
  • SMS channel (v1.6.0).

Workflow

Per feature: SRS use-case → workflow doc → code → CHANGELOG/ROADMAP/TODO → conventional commit → tag (details in WORKFLOW.md).